Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe
-
Size
454KB
-
MD5
f8d60d7847dd8c445ec98695631892d0
-
SHA1
a33b4a20250f2467ce8e61f2e0e497f1f5bb6268
-
SHA256
b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643
-
SHA512
3f092c7bbd6cad4b417be8d8d720d8e993b66ce97afdda052046c05b763b96f593984a4c213c976a1f4ced091e160e42481a618d5c97fb5af2a11823dbbade3f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2644-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-1093-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-1858-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1624 pdpvp.exe 1520 lllxlxl.exe 3884 ntnbtn.exe 2204 jvdvv.exe 3620 dpvjv.exe 2088 rlfrfrx.exe 3544 thhthh.exe 1628 hbhbbt.exe 1664 lxxrfxl.exe 1388 7ddpd.exe 3700 1xxrffx.exe 5020 hthbnh.exe 4640 rxrflrx.exe 2028 3pjdp.exe 1772 7lrlxrf.exe 1348 9nnbbt.exe 116 ffxrllf.exe 1532 5hhbhb.exe 3880 7vdpv.exe 4716 9llfxrl.exe 8 thhhbb.exe 2160 lfxrlff.exe 1048 7lxrffx.exe 1188 5nnbnh.exe 1740 vppdp.exe 4896 lrrfrlf.exe 3136 ttnthn.exe 1692 jvdpp.exe 3972 ppdvj.exe 2732 llfxrlf.exe 3156 bnnbtn.exe 1848 thhtht.exe 2472 dpdpd.exe 776 7bthtn.exe 536 tnhtnb.exe 1160 ddpjp.exe 2844 pddpj.exe 4480 lllflfx.exe 3892 1ttnbt.exe 4000 djpdp.exe 2104 1xrlffx.exe 2008 hnntbh.exe 3840 pddpd.exe 4148 9jdpv.exe 3668 lxffxrx.exe 3052 bhhhtn.exe 5028 btnntb.exe 708 dddvj.exe 4292 xlfrlfr.exe 2600 xlfxfxx.exe 2840 5nhthb.exe 4416 5ddpd.exe 2584 rfflrrx.exe 2256 frlfxlf.exe 1760 nbthbn.exe 2792 vjpdv.exe 3512 xrflfrf.exe 1520 3xxlfrf.exe 4784 5nnhtn.exe 1736 nbbnhb.exe 3180 vjjvj.exe 2808 1rlrfxl.exe 2088 fxlfrlf.exe 1512 nbbnhb.exe -
resource yara_rule behavioral2/memory/2644-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1624 2644 b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe 82 PID 2644 wrote to memory of 1624 2644 b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe 82 PID 2644 wrote to memory of 1624 2644 b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe 82 PID 1624 wrote to memory of 1520 1624 pdpvp.exe 83 PID 1624 wrote to memory of 1520 1624 pdpvp.exe 83 PID 1624 wrote to memory of 1520 1624 pdpvp.exe 83 PID 1520 wrote to memory of 3884 1520 lllxlxl.exe 84 PID 1520 wrote to memory of 3884 1520 lllxlxl.exe 84 PID 1520 wrote to memory of 3884 1520 lllxlxl.exe 84 PID 3884 wrote to memory of 2204 3884 ntnbtn.exe 85 PID 3884 wrote to memory of 2204 3884 ntnbtn.exe 85 PID 3884 wrote to memory of 2204 3884 ntnbtn.exe 85 PID 2204 wrote to memory of 3620 2204 jvdvv.exe 86 PID 2204 wrote to memory of 3620 2204 jvdvv.exe 86 PID 2204 wrote to memory of 3620 2204 jvdvv.exe 86 PID 3620 wrote to memory of 2088 3620 dpvjv.exe 87 PID 3620 wrote to memory of 2088 3620 dpvjv.exe 87 PID 3620 wrote to memory of 2088 3620 dpvjv.exe 87 PID 2088 wrote to memory of 3544 2088 rlfrfrx.exe 88 PID 2088 wrote to memory of 3544 2088 rlfrfrx.exe 88 PID 2088 wrote to memory of 3544 2088 rlfrfrx.exe 88 PID 3544 wrote to memory of 1628 3544 thhthh.exe 89 PID 3544 wrote to memory of 1628 3544 thhthh.exe 89 PID 3544 wrote to memory of 1628 3544 thhthh.exe 89 PID 1628 wrote to memory of 1664 1628 hbhbbt.exe 90 PID 1628 wrote to memory of 1664 1628 hbhbbt.exe 90 PID 1628 wrote to memory of 1664 1628 hbhbbt.exe 90 PID 1664 wrote to memory of 1388 1664 lxxrfxl.exe 91 PID 1664 wrote to memory of 1388 1664 lxxrfxl.exe 91 PID 1664 wrote to memory of 1388 1664 lxxrfxl.exe 91 PID 1388 wrote to memory of 3700 1388 7ddpd.exe 92 PID 1388 wrote to memory of 3700 1388 7ddpd.exe 92 PID 1388 wrote to memory of 3700 1388 7ddpd.exe 92 PID 3700 wrote to memory of 5020 3700 1xxrffx.exe 93 PID 3700 wrote to memory of 5020 3700 1xxrffx.exe 93 PID 3700 wrote to memory of 5020 3700 1xxrffx.exe 93 PID 5020 wrote to memory of 4640 5020 hthbnh.exe 94 PID 5020 wrote to memory of 4640 5020 hthbnh.exe 94 PID 5020 wrote to memory of 4640 5020 hthbnh.exe 94 PID 4640 wrote to memory of 2028 4640 rxrflrx.exe 95 PID 4640 wrote to memory of 2028 4640 rxrflrx.exe 95 PID 4640 wrote to memory of 2028 4640 rxrflrx.exe 95 PID 2028 wrote to memory of 1772 2028 3pjdp.exe 96 PID 2028 wrote to memory of 1772 2028 3pjdp.exe 96 PID 2028 wrote to memory of 1772 2028 3pjdp.exe 96 PID 1772 wrote to memory of 1348 1772 7lrlxrf.exe 97 PID 1772 wrote to memory of 1348 1772 7lrlxrf.exe 97 PID 1772 wrote to memory of 1348 1772 7lrlxrf.exe 97 PID 1348 wrote to memory of 116 1348 9nnbbt.exe 98 PID 1348 wrote to memory of 116 1348 9nnbbt.exe 98 PID 1348 wrote to memory of 116 1348 9nnbbt.exe 98 PID 116 wrote to memory of 1532 116 ffxrllf.exe 99 PID 116 wrote to memory of 1532 116 ffxrllf.exe 99 PID 116 wrote to memory of 1532 116 ffxrllf.exe 99 PID 1532 wrote to memory of 3880 1532 5hhbhb.exe 100 PID 1532 wrote to memory of 3880 1532 5hhbhb.exe 100 PID 1532 wrote to memory of 3880 1532 5hhbhb.exe 100 PID 3880 wrote to memory of 4716 3880 7vdpv.exe 101 PID 3880 wrote to memory of 4716 3880 7vdpv.exe 101 PID 3880 wrote to memory of 4716 3880 7vdpv.exe 101 PID 4716 wrote to memory of 8 4716 9llfxrl.exe 102 PID 4716 wrote to memory of 8 4716 9llfxrl.exe 102 PID 4716 wrote to memory of 8 4716 9llfxrl.exe 102 PID 8 wrote to memory of 2160 8 thhhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe"C:\Users\Admin\AppData\Local\Temp\b6329ceb655bfda78cf2faa27216228ecee0559a7210584a2640e394108fa643.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pdpvp.exec:\pdpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lllxlxl.exec:\lllxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\ntnbtn.exec:\ntnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\jvdvv.exec:\jvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\dpvjv.exec:\dpvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\thhthh.exec:\thhthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\hbhbbt.exec:\hbhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7ddpd.exec:\7ddpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\1xxrffx.exec:\1xxrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\hthbnh.exec:\hthbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\rxrflrx.exec:\rxrflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\3pjdp.exec:\3pjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7lrlxrf.exec:\7lrlxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\9nnbbt.exec:\9nnbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\ffxrllf.exec:\ffxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\5hhbhb.exec:\5hhbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\7vdpv.exec:\7vdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\9llfxrl.exec:\9llfxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\thhhbb.exec:\thhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\lfxrlff.exec:\lfxrlff.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7lxrffx.exec:\7lxrffx.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5nnbnh.exec:\5nnbnh.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vppdp.exec:\vppdp.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrrfrlf.exec:\lrrfrlf.exe27⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ttnthn.exec:\ttnthn.exe28⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jvdpp.exec:\jvdpp.exe29⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ppdvj.exec:\ppdvj.exe30⤵
- Executes dropped EXE
PID:3972 -
\??\c:\llfxrlf.exec:\llfxrlf.exe31⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bnnbtn.exec:\bnnbtn.exe32⤵
- Executes dropped EXE
PID:3156 -
\??\c:\thhtht.exec:\thhtht.exe33⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dpdpd.exec:\dpdpd.exe34⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7bthtn.exec:\7bthtn.exe35⤵
- Executes dropped EXE
PID:776 -
\??\c:\tnhtnb.exec:\tnhtnb.exe36⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddpjp.exec:\ddpjp.exe37⤵
- Executes dropped EXE
PID:1160 -
\??\c:\pddpj.exec:\pddpj.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lllflfx.exec:\lllflfx.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\1ttnbt.exec:\1ttnbt.exe40⤵
- Executes dropped EXE
PID:3892 -
\??\c:\djpdp.exec:\djpdp.exe41⤵
- Executes dropped EXE
PID:4000 -
\??\c:\1xrlffx.exec:\1xrlffx.exe42⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hnntbh.exec:\hnntbh.exe43⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pddpd.exec:\pddpd.exe44⤵
- Executes dropped EXE
PID:3840 -
\??\c:\9jdpv.exec:\9jdpv.exe45⤵
- Executes dropped EXE
PID:4148 -
\??\c:\lxffxrx.exec:\lxffxrx.exe46⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bhhhtn.exec:\bhhhtn.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\btnntb.exec:\btnntb.exe48⤵
- Executes dropped EXE
PID:5028 -
\??\c:\dddvj.exec:\dddvj.exe49⤵
- Executes dropped EXE
PID:708 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe50⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xlfxfxx.exec:\xlfxfxx.exe51⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5nhthb.exec:\5nhthb.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5ddpd.exec:\5ddpd.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rfflrrx.exec:\rfflrrx.exe54⤵
- Executes dropped EXE
PID:2584 -
\??\c:\frlfxlf.exec:\frlfxlf.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbthbn.exec:\nbthbn.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vjpdv.exec:\vjpdv.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrflfrf.exec:\xrflfrf.exe58⤵
- Executes dropped EXE
PID:3512 -
\??\c:\3xxlfrf.exec:\3xxlfrf.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5nnhtn.exec:\5nnhtn.exe60⤵
- Executes dropped EXE
PID:4784 -
\??\c:\nbbnhb.exec:\nbbnhb.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vjjvj.exec:\vjjvj.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\1rlrfxl.exec:\1rlrfxl.exe63⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe64⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nbbnhb.exec:\nbbnhb.exe65⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvvpv.exec:\dvvpv.exe66⤵PID:2664
-
\??\c:\dpjvj.exec:\dpjvj.exe67⤵PID:3544
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe68⤵PID:800
-
\??\c:\7nhthb.exec:\7nhthb.exe69⤵PID:468
-
\??\c:\pjjdp.exec:\pjjdp.exe70⤵
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\vjdpd.exec:\vjdpd.exe71⤵PID:228
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe72⤵PID:1720
-
\??\c:\nbthtn.exec:\nbthtn.exe73⤵PID:2916
-
\??\c:\5pjvj.exec:\5pjvj.exe74⤵PID:372
-
\??\c:\dddvj.exec:\dddvj.exe75⤵PID:1644
-
\??\c:\5xlxfxr.exec:\5xlxfxr.exe76⤵PID:2084
-
\??\c:\nhnbth.exec:\nhnbth.exe77⤵PID:2628
-
\??\c:\nhbnhb.exec:\nhbnhb.exe78⤵PID:2028
-
\??\c:\jddvv.exec:\jddvv.exe79⤵PID:2556
-
\??\c:\rrfxlfx.exec:\rrfxlfx.exe80⤵PID:4992
-
\??\c:\tnhtbt.exec:\tnhtbt.exe81⤵PID:1348
-
\??\c:\1jdvj.exec:\1jdvj.exe82⤵PID:4616
-
\??\c:\vdjdv.exec:\vdjdv.exe83⤵PID:520
-
\??\c:\3lrffxr.exec:\3lrffxr.exe84⤵PID:4404
-
\??\c:\nhbntn.exec:\nhbntn.exe85⤵PID:764
-
\??\c:\7nnbhb.exec:\7nnbhb.exe86⤵PID:4736
-
\??\c:\vddpd.exec:\vddpd.exe87⤵PID:4508
-
\??\c:\xfrlxrf.exec:\xfrlxrf.exe88⤵PID:964
-
\??\c:\3hnbnb.exec:\3hnbnb.exe89⤵PID:2160
-
\??\c:\dppjv.exec:\dppjv.exe90⤵PID:2476
-
\??\c:\jjdjv.exec:\jjdjv.exe91⤵PID:3108
-
\??\c:\rffrfxl.exec:\rffrfxl.exe92⤵PID:1616
-
\??\c:\btnbhb.exec:\btnbhb.exe93⤵PID:3876
-
\??\c:\5pdpj.exec:\5pdpj.exe94⤵PID:1200
-
\??\c:\dvdvd.exec:\dvdvd.exe95⤵PID:4780
-
\??\c:\xffrxrl.exec:\xffrxrl.exe96⤵PID:1296
-
\??\c:\tbtnbt.exec:\tbtnbt.exe97⤵PID:4836
-
\??\c:\pppdp.exec:\pppdp.exe98⤵PID:368
-
\??\c:\pddjv.exec:\pddjv.exe99⤵PID:3644
-
\??\c:\rrlxlfl.exec:\rrlxlfl.exe100⤵PID:1816
-
\??\c:\thhtht.exec:\thhtht.exe101⤵PID:4136
-
\??\c:\3nnhnh.exec:\3nnhnh.exe102⤵PID:4624
-
\??\c:\dppdp.exec:\dppdp.exe103⤵PID:1152
-
\??\c:\7djdd.exec:\7djdd.exe104⤵PID:760
-
\??\c:\3rrflfr.exec:\3rrflfr.exe105⤵PID:2992
-
\??\c:\1bnhtb.exec:\1bnhtb.exe106⤵PID:2776
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:4604
-
\??\c:\jvvjv.exec:\jvvjv.exe108⤵PID:2404
-
\??\c:\7xrlxrf.exec:\7xrlxrf.exe109⤵PID:852
-
\??\c:\nhhbhb.exec:\nhhbhb.exe110⤵PID:3276
-
\??\c:\tbtbbh.exec:\tbtbbh.exe111⤵PID:1712
-
\??\c:\jvvjv.exec:\jvvjv.exe112⤵PID:3716
-
\??\c:\llxlflf.exec:\llxlflf.exe113⤵PID:2212
-
\??\c:\bttnhb.exec:\bttnhb.exe114⤵PID:4464
-
\??\c:\pjpdd.exec:\pjpdd.exe115⤵PID:1608
-
\??\c:\5pjvj.exec:\5pjvj.exe116⤵PID:1080
-
\??\c:\rffxfxr.exec:\rffxfxr.exe117⤵PID:1040
-
\??\c:\thhthb.exec:\thhthb.exe118⤵PID:4332
-
\??\c:\pdvjv.exec:\pdvjv.exe119⤵
- System Location Discovery: System Language Discovery
PID:4656 -
\??\c:\frlfxlf.exec:\frlfxlf.exe120⤵PID:2632
-
\??\c:\3flfxrl.exec:\3flfxrl.exe121⤵PID:2600
-
\??\c:\tbbtnh.exec:\tbbtnh.exe122⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-